ALPINE-CVE-2022-46146

See a problem?
Please try reporting it to the source first.

Source

https://security.alpinelinux.org/vuln/CVE-2022-46146

Import Source

https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json

JSON Data

https://api.osv.dev/v1/vulns/ALPINE-CVE-2022-46146

Upstream

CVE-2022-46146

Published

2022-11-29T14:15:13Z

Modified

2026-11-03T07:30:52Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Prometheus Exporter Toolkit is a utility package to build exporters. Prior to versions 0.7.2 and 0.8.2, if someone has access to a Prometheus web.yml file and users' bcrypted passwords, they can bypass security by poisoning the built-in authentication cache. Versions 0.7.2 and 0.8.2 contain a fix for the issue. There is no workaround, but attacker must have access to the hashed password to use this functionality.

References

https://security.alpinelinux.org/vuln/CVE-2022-46146

Affected packages

Alpine:v3.17

prometheus

Package

Name: prometheus
Purl: pkg:apk/alpine/prometheus?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.40.5-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

prometheus-node-exporter

Package

Name: prometheus-node-exporter
Purl: pkg:apk/alpine/prometheus-node-exporter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

Alpine:v3.18

prometheus

Package

Name: prometheus
Purl: pkg:apk/alpine/prometheus?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.40.4-r1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

prometheus-node-exporter

Package

Name: prometheus-node-exporter
Purl: pkg:apk/alpine/prometheus-node-exporter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

Alpine:v3.19

prometheus

Package

Name: prometheus
Purl: pkg:apk/alpine/prometheus?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.40.4-r1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

prometheus-node-exporter

Package

Name: prometheus-node-exporter
Purl: pkg:apk/alpine/prometheus-node-exporter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

Alpine:v3.20

prometheus

Package

Name: prometheus
Purl: pkg:apk/alpine/prometheus?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.40.4-r1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

prometheus-node-exporter

Package

Name: prometheus-node-exporter
Purl: pkg:apk/alpine/prometheus-node-exporter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

Alpine:v3.21

prometheus

Package

Name: prometheus
Purl: pkg:apk/alpine/prometheus?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.40.4-r1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

prometheus-node-exporter

Package

Name: prometheus-node-exporter
Purl: pkg:apk/alpine/prometheus-node-exporter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

Alpine:v3.22

prometheus

Package

Name: prometheus
Purl: pkg:apk/alpine/prometheus?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.40.4-r1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

prometheus-node-exporter

Package

Name: prometheus-node-exporter
Purl: pkg:apk/alpine/prometheus-node-exporter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

Alpine:v3.23

prometheus

Package

Name: prometheus
Purl: pkg:apk/alpine/prometheus?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.40.4-r1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

prometheus-node-exporter

Package

Name: prometheus-node-exporter
Purl: pkg:apk/alpine/prometheus-node-exporter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

Alpine:v3.24

prometheus

Package

Name: prometheus
Purl: pkg:apk/alpine/prometheus?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.40.4-r1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"

prometheus-node-exporter

Package

Name: prometheus-node-exporter
Purl: pkg:apk/alpine/prometheus-node-exporter?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.5.0-r0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2022-46146.json"